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Abstract — Lattice coding over a Gaussian wiretap channel, 
where an eavesdropper listens to transmissions between a trans- 
mitter and a legitimate receiver, is considered. A new lattice 
invariant called the secrecy gain Q] is used as a code design 
criterion for wiretap lattice codes since it was shown to char- 
acterize the confusion that a chosen lattice can cause at the 
eavesdropper: the higher the secrecy gain of the lattice, the 
more confusion. In this paper, a formula for the secrecy gain 
of unimodular lattices is derived. Secrecy gains of extremal odd 
unimodular lattices as well as unimodular lattices in dimension 
n, 16 < n < 23 are computed, covering the 4 extremal odd 
unimodular lattices and all the 111 non-extremal unimodular 
lattices (both odd and even) providing thus a classification of 
the best wiretap lattice codes coming from unimodular lattices 
in dimension n, 8 < n < 23. Finally, to permit lattice encoding 
via Construction A, the corresponding error correction codes are 
determined. 

Index Terms — Gaussian channel, Lattice codes, Secrecy gain, 
Theta series, Wiretap codes, Unimodular lattices. 

I. Introduction 

In his seminal work, Wyner [2] introduced the wiretap 
channel, a discrete memoryless channel where the sender 
Alice transmits confidential messages to a legitimate receiver 
Bob, in the presence of an eavesdropper Eve. Both reliable 
and confidential communication between Alice and Bob is 
shown to be achievable at the same time, by exploiting the 
physical difference between the channel to Bob and that to 
Eve, without the use of cryptographic means. Many results 
of information theoretical nature are available in the literature 
for various classes of channels ranging from Gaussian point- 
to-point channels to relay networks (see e.g. Q for a survey) 
capturing the trade-off between reliability and secrecy and 
aiming at determining the highest information rate that can be 
achieved with perfect secrecy, the so-called secrecy capacity. 
Coding results focusing on constructing concrete codes that 
can be implemented in a specific channel are much fewer (see 
E), 121 for examples of wiretap codes dealing with channels 
with erasures). 

In this paper, we will focus on Gaussian wiretap channels, 
whose secrecy capacity was established in (6). Examples of 
existing Gaussian wiretap codes were designed for binary 
inputs, as in Q, 0. A different approach was adopted in (T), 
where lattice codes were proposed, using as design criterion a 
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new lattice invariant called secrecy gain, which was shown to 
characterize the confusion at the eavesdropper. This suggests 
the study of the secrecy gain of lattices as a way to understand 
how to design a good Gaussian wiretap code. Unimodular 
lattices were shown to be good candidates in J9) and for 
even unimodular lattices, both secrecy gains for a special 
class of lattices called extremal lattices were computed and 
the asymptotic behavior of the average secrecy gain as a 
function of the dimension n was investigated. These two 
papers were further developed in 1101 . where coding examples 
were detailed and it was shown that as n grows to infinity, 
all even unimodular lattices behave in the same way, so that 
optimizing the secrecy gain makes sense in small dimensions. 

The work of |9), iflOl deals with even unimodular lattices, 
which only exist in dimensions a multiple of 8. We pursue the 
study of unimodular lattices by considering odd unimodular 
lattices, which on the contrary exist in every dimension and 
in great number, giving thus more flexibility in the code 
design. We will also show examples of odd unimodular lattices 
outperforming even unimodular lattices. Our contributions can 
be summarized as follows: 

• We develop a general formula for the secrecy gain of 
both odd and even unimodular lattices that generalizes 
the existing one for even unimodular lattices. 

• We obtain the secrecy gain of unimodular lattices in 
dimension n, 8 < n < 23, covering the 4 extremal odd 
unimodular lattices as well as all the 111 non-extremal 
unimodular lattices. 

• We classify the best Gaussian wiretap codes from uni- 
modular lattices in dimension n, 8 < n < 23, together 
with their corresponding self-dual codes enabling lattice 
encoding via Construction A. 

The remainder of this paper is organized as follows. In 
Section II, we first give a brief introduction to unimodular 
lattices and their theta series as well as recall the definition of 
the secrecy gain and the previous results concerning this lattice 
invariant. The main results are given in Section III. An explicit 
formula for the secrecy gain of unimodular lattices is derived, 
which generalizes the one for the even case in fiol . Secrecy 
gains of extremal odd unimodular lattices are computed to 
complete the study of extremal unimodular lattices. Finally, se- 
crecy gains of unimodular lattices in dimension 16 < n < 23, 
both odd and even, are computed, ending the classification of 
unimodular wiretap lattice codes in dimension n, 8 < n < 23. 
In Section IV, encoding of the best codes via Construction A 
is discussed. 
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II. Preliminaries and previous results 

Consider a Gaussian wiretap channel, which is modeled 
as follows: Alice wants to send data to Bob on a Gaussian 
channel whose noise variance is given by cr 2 . Eve is the 
eavesdropper trying to intercept data through another Gaussian 



have a positive secrecy capacity [6J. More precisely, the model 
is 

y = x + v b 

Z = X + V e , 



(1) 



where x is the transmitted signal, v b and v e denote the 
Gaussian noise vectors at Bob's, respectively Eve's side, each 
component of both vectors with zero mean, and respective 
variance cr 2 and <j\, and finally y and z are the received signals 
at Bob's, respectively Eve's side. In this paper, we choose x 
to be a codeword coming from a specially designed lattice 
of dimension n, namely, we consider lattice coding. Let us 
thus start by recalling some concepts concerning lattices, in 
particular, unimodular lattices. 



A. Unimodular lattices 

A lattice A is a discrete set of points in W l , which can be 
described in terms of its generator matrix M by 



A = {x = uM|u € Z n }, 



where 
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and the row vectors 
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3 ^m)i ^ 





1, 2, ••• , n 
form a basis of the lattice. The matrix 

A = MM T , 

where M T denotes the transpose of M, is called the Gram 
matrix of the lattice. It is easy to see that the (i,j)th entry of 
A is the inner product of the ith and jth row vectors of M, 
denoted by 

A {id) =v i -v i . 

A lattice A is called an integral lattice if its Gram matrix 
is an integral matrix. The determinant detA of a lattice A is 
the determinant of the matrix A, which is independent of the 
choice of the matrix M. A fundamental region for a lattice 
is a building block which when repeated many times fills the 
whole space with just one lattice point in each copy. There are 
many different ways of choosing a fundamental region for a 
lattice A, but the volume of the fundamental region is uniquely 
determined by A and called the volume of A, which is exactly 
V detA. Let us see an example of a fundamental region of a 
lattice. A Voronoi cell Va(x) of a lattice point x in A consists 
of the points in the space that are closer to x than to any other 
lattice points of A. 

The dual of a lattice A of dimension n is defined to be 



It can be shown that A is an integral lattice if and only if A C 
A*. Especially, if A = A* then A is called a unimodular lattice. 
It can further be shown that A is a unimodular lattice if and 
only if A is integral and det A = 1. Finally, the norm (squared 
length) ||x|| 2 =x-xofa lattice point x in a unimodular lattice 
A is of course an integer. If the norm is an even integer for any 
lattice point in A, then A is called an even unimodular lattice 
or a type II lattice. Otherwise, it is called an odd unimodular 
lattice or a type I lattice. 

There are certain lattices which play the role of building 
blocks in analyzing lattices. They are denoted by A n , D n , 
Eq, Ej, Eg, and are called irreducible root lattices ifTTI . 
Unimodular lattices are then decomposed into a number of 
such lattices. More precisely, an n-dimensional unimodular 
lattice A is described as one containing a sublattice which is 
the direct sum 

Ai © A 2 © • • • 8 A fe 

of a number of irreducible root lattices of total dimension n, 
and consequently a lattice point of A can be written as 



x = Xi + x 2 



x k , 



where each component Xi is chosen as one of a standard 
system of representatives for the cosets of Aj in A* and called 
a glue vector for A,. Informally speaking, A is obtained by 
gluing together the components Ai, A 2 , • ■ ■ , A^ by the glue 
vectors. The existence of glue vectors will be indicated by " + " 
all through this paper. Let us see an example of the simplest 
case that is called self-glue. 

Example 2.1: We use (r m ) to denote a string of m r's here. 
The lattice Df 2 = Di 2 U D\ 2 + (§ ) contains D12 as a 
sublattice and a lattice point of Df 2 can be written as x = 
xi, xi e D12 + (0 12 ) or x = xi, xi e D 12 + {\ 12 ), where 
the vectors (0 12 ) and (| ) are the glue vectors for D\2- 

A complete list of unimodular lattices of dimension n, < 
n < 23 that contain no vector of norm 1 is given in lfl2l . each 
lattice is described by its components. The kissing number of 
a lattice (sphere) packing is the number of spheres that touch 
one sphere. The kissing numbers of these unimodular lattices 
are also given in the same table. 

Let us recall the definition of the Jacobi theta functions and 
the theta series of lattices before we end this subsection. Let 
H = {a + ib € C\b > 0} denote the upper half plane and let 
q = e" T , where r E H. 

Definition 2.2: Jacobi theta functions are defined as fol- 
lows: 

7 («+|) 2 



Mr) 
Mr) 
Mr) 



= ^ ne z{-q) n2 



A* 



{xe R" : x- A e Z,A G A}. 



They are very important functions in analytic number the- 
ory. For example, the discriminant function Ag(r) can be 
represented by $2(t) and i?4(r) |[T2l : 

A 8 (r) =5^(t)01(t) 
= 2-80§(z±l) 

= 9ir =1 {(i-<? 2 

= q - 8q 2 + 28q 3 - 

(2) 



'-^(l - q 4m )} s 
64 9 4 + 126g 5 + 224q 6 
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Definition 2.3: The theta series of a lattice A is defined by 



e A (r) 



^AeA<7 



XX 



If we combine the terms with the same exponent, the theta 
series of an integral lattice A can be written as 



0a(t) = £~ =0 A,g n 



(3) 



By doing that we can interpret the theta series of A as a book 
keeping device recording the number of vectors A € A with 
norm n in the coefficient A n . Take the one-dimensional lattice 
Z for example and recall the definition of the Jacobi function 
$3(t). We have 



3 ( T ) = z (t) = l + 2q 1 + 2q 4 + 2q 9 + 



(4) 



Similarity, the theta series of the /c-dimensional lattice Z fc is 
then 



e zfc (r)=tf 3 (T)' 



(5) 



Theta series of lattices are well studied object in analytic 
number theory. Here is a well known result concerning theta 
series of unimodular lattices. 

Lemma 2.4: (Hecke) lfl2l If A is a unimodular lattice then 

e A (r)eC[0 3 (T),A 8 (r)]. 

This lemma tells us that the theta series of any unimodular 
lattice can be generated by #3(1-) and Ag(r). These objects we 
have discussed in the last part of this subsection are actually 
modular forms. Interested readers may refer to |[T3l for an 
introduction. 



B. Previous results 

Lattice encoding for the wiretap channel (Q3 is done via a 
generic coset coding strategy JTJ : let A e C Ab be two nested 
lattices. A /c-bit message is mapped to a coset in A(,/A e , 
after which a vector is randomly chosen from the coset as the 
encoded word. The lattice A e can be interpreted as introducing 
confusion for Eve, while A& is intended to ensure reliability 
for Bob. Since a message is now corresponding to a coset 
of codewords instead of one single codeword, the probability 
of correct decoding is then summing over the whole coset 
(suppose that we do not have power constraint and are utilizing 
the whole lattice to do the encoding). Here we are interested 
in computing Eve's probability of correct decision 



Pr 



E 

teA e 



-lly- 



V Ab ( x +t) (v e v2Tr) r 



dy. 



With a change of variable and applying the Taylor expansion 
to the exponential function, the value of P c e is approximated 
in E0) by 



E 

t£A e 



x/deiAT ( x _ U(V Ab 



where 



(cr e V27r)" V 2cr2^detA b 
W(V A J= / ||x|| 2 du 

JVa, 



is the unnormalized second moment of A5. Since v / detA~6 
and U(VA b ) are invariants of A&, to minimize P ce is then 
to minimize 

teA e 



which is easily recognized as the theta series of A e at r 



Motivated by the above argument, the confusion brought by 
the lattice A e with respect to no coding (namely, use a scaled 
version of the lattice Z™ with the same volume) is measured 
as follows: 

Definition 2.5: JT] Let A be an n-dimensional lattice of 
volume v n . The secrecy function of A is given by 



-a r 



QvZ»{T) 

6 a (t) 



TSU. 



The secrecy gain is then the maximal value of the secrecy 
function with respect to r and is denoted by \A- 




Fig. 1 . Secrecy function of E% 



A large class of lattices was shown to have a symmetry 

in their 



point (called weak secrecy gain) at t 



(detA) s 



secrecy function through the Poisson summation formula iflOl . 
For example, Fig. 1 shows the secrecy function Se 8 (t) of Eg, 
where 1) we set y = —vr and restrict to real positive values 
of y, since by (|6]l we are only interested in the values of 
@£ S ( T ) w i m T — Vh V > an d 2) y is plotted in decibels to 
transform the multiplicative symmetry point into an additive 
symmetry point. The symmetry point can be seen to be y = 
dB corresponding to y = 1, and hence to r = i. This class 
of lattices contains lattices whose duals are obtained from 
themselves by possibly a rotation, reflection, and change of 
scale. Let us now focus on unimodular lattices, for which we 
have A* = A by definition. It was a conjecture by Belfiore and 
Sole [9], that for these lattices, r = i is not only the symmetry 
point, but also the point achieving the secrecy gain: 



XA = 



Ml 
e A (*)' 



(7) 



This conjecture was recently proven by A.-M. Ernvall-Hytonen 
03), lfT31 for a special class of lattices called extremal even 
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unimodular lattices. The idea of the proof is to write the 
secrecy function of a lattice A as a function of the quantity 

_ 16A 8 (r) _ ^(r)^(r) 



She shows that 



* G [0, j] 



and that the maximum j of z is achieved at r = t. The rest 
of the proof consists of showing that the function f\(z) is 
increasing in [0, j]. Later we will prove the conjecture for 
extremal odd unimodular lattices as well as unimodular lattices 
in small dimensions using this idea. 

III. The secrecy gain of unimodular lattices 

For the sake of convenience, we will assume that the 
symmetry point r = i is really the maximum of the secrecy 
function through this section. We will then justify the claim 
for the specific lattices we discuss, but note that the general 
conjecture is still open. 

A. A general formula 

We are now ready to give our first result, namely a general 
formula for the secrecy gain of unimodular lattices. From 
Lemma [2~4l we have the following decomposition of the theta 
series of a unimodular lattice A: 

[f] 

9 A (r) =J2^- 8r (r)A r 8 (r),a r e Z. (8) 

r=0 

Consequently, the reciprocal of the secrecy gain of A is 

1/v» - 

— r, / A sQ') \r 

— 2^r=0 a r\~W(j)) 

— l^r=0 a r( I 

where the first equality follows from (0, the second from (|S), 
the fourth from (|2), and the final equality from the following 
two useful equations concerning the Jacobi theta functions at 
r = i C2l: 



Mi) = &&) and Mi) = y^Mi) 



(9) 



To summarize: 

Theorem 3.1: The secrecy gain of a unimodular lattice A 
of dimension n can be written as 

Xa = m 1 - - , (10) 

where the a,'s are the coefficients in (HJ. 

This generalizes the formula for the even case in iflOl . 

Fig. 2 gives the plot of the secrecy function of the odd 
unimodular lattice D\ 2 mentioned in Example 2.1 (see the 
paragraph following Fig. 1 for an explanation of the variable 
y). The maximum can be seen to be |, which we will verify 
in the next subsection. 




Fig. 2. Secrecy function of D^~ 2 



B. Extremal odd unimodular lattices 

In order to find good Gaussian wiretap lattice codes, we 
look for unimodular lattices with high secrecy gain. We start 
by restricting our search to the class of extremal unimodular 
lattices. 

Definition 3.2: Let A be a lattice of dimension n. A is said 
to be an extremal lattice if its minimal norm is [^] + lQ 

By definition, an extremal unimodular lattice A of dimen- 
sion n contains no vector of norm 1, 2, ••• , [f], thus the 
coefficients of q, q 2 , ■■■ , q^ in the theta series given in (0) 
are all 0's. But by expanding ([8]), we can form another formal 
sum with coefficients represented as linear combinations of 
a,'s. Then by comparing the first [j] + 1 terms of the two 
formal sums, we have a system of [2] linear equations in 
[^] unknowns ai, a,2, ••• , ojaj (do is obviously 1), from 
which a unique solution can be found. In this way, the secrecy 
gain of each extremal unimodular lattice can be computed. We 
illustrate this technique by computing the secrecy gain of D^ 2 
and 2 3- 

Secrecy gain of D^ 2 . The theta series of D\ 2 looks like 

Q D + (r) = 1 + 0q + A 2 q 2 + ■■■ , A 2 ^0. 

On the other hand, by ©, © and ©, 

©d+( t ) =^ 2 (r)+ ai ^A 8 (r) 

= (1 + 2q + ■ ■ ■ ) 12 + Oi(l + 2q + ■ ■ ■ ) 4 {q +■■■) 

= (l + 24gH )+ai(q-\ ) 

= 1 + (24 + ai)q H . 

We now have one linear equation in one unknown a\ 

24 + oi = 0, 

which gives a\ = —24, yielding the secrecy gain 

1 8 



12 1 _ 



24 



(ID 



Secrecy gain of 023- The theta series of the Shorter Leech 
Lattice O23 again looks like 

6o 23 (t) = 1 + 0q + Oq 2 + A 3 q 3 + ■■■ , A3 ? 0. 

'The definition of extremal has changed. Here we use the earlier version. 
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TABLE I 

SECRECY GAINS OF EXTREMAL ODD UNIMODULAR LATTICES 



dim 


lattice 


theta series 


secrecy gain 


12 




>&l 2 - 24tf|A 8 


8 


14 




#! 4 - 28tf§A 8 


lb 


15 


A + 


- 30i?£A 8 


32 
17 


23 


o 23 


■fff - 460£ 6 A 8 





On the other hand, by ©, © and © 

eo 23 (r) = 0§ 3 (r) + ai ^ 5 (r)A 8 (r) + a 2l ? 3 7 (T)A 2 (r) 
= (l + 2g + --.) 23 

+ai(l + 2g+---) 15 (g- 

+a 2 (l + 2q+---) 7 (q-8 
= (l + 46g + 1012g 2 + ---; 

+ ai (q + 22q 2 -\ ) + a 2 (q 2 

= 1 + (46 + ai)q 

+ (1012 + 22a 1 +a 2 )< ? 2 + --- . 

This time, we have two linear equations in ai and a 2 



+ •••) 



+ ■■■) 



46 + ai 
1012 + 22ai 



which gives a\ = —46 and a 2 



1 



Xo 2 



1 



46 
217 



= 
-a 2 =0 

0, yielding 
32 
9"' 



By applying this method, we have computed the secrecy 
gain for each extremal odd unimodular lattice in dimension 
7i, n > 10 (see lfl2l for a classification), as shown in Table I. 
A similar table for the even case can be found in (9), iflOl . 

Proposition 3.3: The secrecy conjecture is true, namely, the 
maximum of the secrecy function is achieved at r = i for 
extremal odd unimodular lattices and the secrecy gains are 
given as in Table I. 

Proof. The secrecy gains are computed as illustrated in the 
examples of D\ 2 and 2 3. Now we only need to show that the 
secrecy gains of these unimodular lattices are indeed achieved 
at t = 2. Recall the definition of secrecy function and the theta 
series of Df 2 , which we have just computed. We have that 

-D+ 2 ( T ) ~ tff(T)-24^(T)A 8 (T) 



where z 



Recall also that it was shown in [14] 

that z € [0, j] and j is achieved at r = i. It then suffices 
to show that the denominator is decreasing in [0, i], which is 
obviously true, since its derivative is negative in [0, 4]. Thus 
the maximum of the secrecy function is achieved at z = 4, 
namely, r = i. 

We do the same for the other three extremal odd unimodular 
lattices, namely: 



( T ) 



" tfi*(T)-28tf«(T)A 8 (T; 

= i _ '2Hz , 
1 16 

i?i 5 (r)-30fl(r)A 8 (r) 
1 i « 



-o 23 (^) 



^ 3 i (r)-46^ 5 (r)A 8 (r) 

1 46^ 



16 

That the maximum of each secrecy function is achieved at z = 
i, namely, r = i follows similarly. The proof is completed. 

A unimodular lattice containing vectors of norm 1 can 
always be written as the direct sum of a unimodular lattice 
without vectors of norm 1 and a cubic lattice Z fe lfl2l . From 
the definition of the secrecy function, we have that the secrecy 
gain is determined by the component that contains no vector 
of norm 1. In fact, 



XA®Z k 



(*) 

e A (i) 



XA- 



By refering to the enumeration of unimodular lattices lfl2l . 
the lattices E%, Df 2 , (E^) + and Af 5 are the only unimodular 
lattices that do not contain vectors of norm 1 in dimensions 
less than 16. The secrecy gain of E$ was computed in |9l , 
IflOl and observe that the secrecy gains of these three lattices 
are already given in Table I. Thus we in fact have all the best 
unimodular lattices in dimension n, 8 < n < 16, namely, 
Eg © Z in dimension 9, E 8 © Z 2 in dimension 10, E 8 © Z 3 
in dimension 11, D^ 2 in dimension 12, D^ 2 ©Z in dimension 
(12) (^?) + m dimension 14 and A^ 5 in dimension 15. 

We will deal with unimodular lattices in dimension n, 16 < 
n < 23 in the next subsection. 



C. Unimodular lattices in small dimensions 

The computation of secrecy gain of extremal unimodular 
lattices can easily be adapted to cover a large family of uni- 
modular lattices, namely, non-extremal unimodular lattices that 
do not contain vectors of norm 1 in dimensions 16 < n < 23. 

We show the computation of the secrecy gain of (-D|) + to 
illustrate the technique before deriving a general formula of 
the secrecy gain for all the 111 lattices and proving the secrecy 
conjecture for these lattices. 

Secrecy gain of (-Df ) + . The lattice (-D|) + does not contain 
any vector of norm 1. Thus the corresponding coefficient A\ 
in the theta series is 0. Its kissing number is 224, which means 
that the first nonzero coefficient A 2 = 224 and the theta series 
of (Dl)+ looks like 



9 (jD 2 )+ (r) = 1 + Oq + 224<7 2 + A 3 q 3 + ■■■ . 

On the other hand, by ©, © and ©, 

e P |) + (r) = ^ 6 (r) + a^l(r)A 8 (r) + a 2 A 2 (r) 
= (l + 2q+ 

+ai(l + 2q+ ■ ■ ■ f{q - 8q 2 + ■ ■ •) 

+a 2 (q — 8q 2 H ) 2 

= (1 + 32q + 480g 2 + • • ■ ) 



(13) 



-a±(q + 



+ 



)+a 2 (q 2 + ---) 



= 1 + (32 + a x )q + (480 + 8a x + a 2 )q 2 + 
This time, we have two linear equations in a\ and a 2 



32 + a! 
480 + 8ai + a 2 





224 
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which gives a\ 



-32 and a 2 = 0, yielding 
1 



X(DIY 



1 _ 32 
1 2 6 



= 2. 



(14) 



We now derive a general formula for the secrecy gain of all 
the 111 non-extremal unimodular lattices. 

Proposition 3.4: The secrecy gain conjecture is true, 
namely, the secrecy gain is achieved at r = i for non-extremal 
unimodular lattices in dimension 16 < n < 23 and the secrecy 
gain is given by 

(15) 



1 - 



2n(n-23)+K(A) 
2" 



where K(A) denotes the kissing number of A. 

Proof. The theta series of a lattice A in question looks like 



6 A (t) = 1 + Oq + K(A)q 2 + A a q 3 + 
On the other hand, by ©, © and © 



(16) 



e A (r) = 0£(r) + a^r 8 (r)A 8 (r) + a 2 ^ 16 (r)A 2 (r) 



) n ~ 8 (q - 8q 2 + 
) n ~ 16 lq - 8q 2 




q 



= (1 + 2nq + 2n(n - l)q 2 + ■ 
+ ai {q + (2n - 24)q 2 + ••■) 
+a 2 {q 2 + ■•■) 

= 1 + (2n + ai )q 
+ (2n(n - 1) + (2n - 24)ai 



)(?- 



Now by comparing the two expressions of 9a, we have two 
linear equations in a\ and a 2 





K{A) ' 



2n + cii 
2n(n - 1) + (2n - 24)ai + a 2 

which gives a\ = —2n and a 2 = 2n(n — 23) + K(A), yielding 
from the conjecture 

1 

XA 



1 _ 2n 

1 2 6 



2ra(Tt-23)+if (A) 
2 12 



We have yet to show that the maximum is indeed achieved 
at r = i. Recalling the definition of secrecy function and the 
theta series we have just computed, the secrecy function of A 
can be written as 

^ A ^ T ) ~ ^(r)-2mJ^ s (T)A 8 (T) + (2n(n-23)+if(A))iJ™" lei (T)A2 

= I 2n I 1 2n(r.-23) + if (A) 2 

16 T7^ z 



where D(z) = 1-%*+ ^-%+*^ and z = ^WgW. 

Recall again that it was shown in lfT4l that z € [0, |] and | 
is achieved at r = i. It suffices to show that the denominator 
£>(z) is decreasing in [0, j]. We now examine the derivative 



of the denominator. Note that z S [0, i], 16 < n < 23 and the 
largest kissing number for these lattice is 760. Now, 

_ n , 2ra(K-23) + g(A) 



D(z) 



8 1 2^ 

^ n , 2n(n-23) + K(A) 

S - 8 H 55 

_ -64n+2n(Ti-23)+A'(A) 

— 29 
-1024+0+jC(A) 

2 9 

_ A'(A)-1024 
^ 760-^024 

^ ¥> 

< 0. 



This tells us that the denominator D(z) is decreasing in [0, i] 
and the maximum of the secrecy function is achieved at z = |, 
namely, r = i. The proof is completed. 

Table II @ summarizes the secrecy gains we have computed. 
Observe that 

1) In dimension 16, the odd unimodular lattice (D$) + 
has secrecy gain 2, which outperforms its two even 
counterparts (E$) + and D^ 6 , both with secrecy gain 

2) In fact, when the dimension n is fixed the secrecy gain is 
totally determined by the kissing number A 2 . The lattice 
with the best secrecy gain (in boldface) is the one with the 
smallest kissing number, which can also be seen directly 
from <TT~5T >. This agrees with the observation in [10] that 
the best secrecy gain is achieved by extremal lattices, 
for being extremal in this special case is equivalent to 
having A 2 = 0. We do not know yet if the secrecy gain 
is connected to the kissing number in general. 

In iflOl . a lower bound on the minimal secrecy gain as a 
function of n from Siegel-Weil formula for even unimodular 
lattices was computed. In Fig. 3, the points corresponding to 
best unimodular lattices are compared to the bound. Note that 
all the points are the secrecy gains of odd lattices, except for 
Eg in dimension 8. We observe that when n grows, the gap 
between the lower bound and the best lattices decreases, as 
suggested in IflOl . where it was shown that when n increases, 
the difference of secrecy gain becomes negligible. 

IV. Gaussian wiretap codes from unimodular 

LATTICES 

As mentioned in Section II, the secrecy gain of a lattice A 
characterizes the amount of confusion at Eve that is gained 
by using this lattice A as A e in the lattice coset code A e C 
Af,. Now that we have established the secrecy gain of all the 
unimodular lattices in dimension smaller than 24, we need 
to be able to use these lattices, particularly those with the 

highest secrecy gain to provide lattice coset codes. To do so, 

( T 'lattice encoding should be performed, which can be handled 
via Construction A, assuming that we can associate to the 
chosen lattice a suitable error correction code. We will use 
some terminology from classical error correction codes in this 
session. Unfamiliar readers can refer to lfl6l . 

2 Ofc in the table denotes an empty component of dimension k, namely, one 
containing no vector of norm less than or equal to 2. Also, for the sake of 
simplicity, we omit the "+" which denotes the existence of glue vectors. 
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TABLE II 

Secrecy gains of non-extremal unimodular lattices of 
dimension n, 16 < n < 23 



dim 


lattice 


kissing number 


secrecy gam 


16 


E i 


480 


IB 


16 


D 16 


480 


A 

LI 


16 


D' J 

8 


224 


2 


17 


A\\Ee 


204 


1 k 


18 


A 17 Ai 


308 


32 

£ 


18 


D 10 E 7 Ai 


308 


— n — 


18 


6 


180 


— h — 


18 


Al 

9 


180 


7 


1 Q 

iy 




Ol « 

ZIO 


b4 


1 o 

iy 


a , , n~/^">, 
^llli^TCl 


Ol « 
Z1D 


§3 

27 


19 




152 


82 
13 


20 


D 2 


760 


32" 

— s 


20 


D 12 E 8 


504 


li 


20 


D 12 D 8 


376 


& 


20 




312 




on 

zU 


A n 


osn 

ZoU 


— s — 
— 1 — 


ill 


n ' 2 - n , 

Ug U 4 


OAS 




on 

zU 




Ol A 

ZIO 


— m — 


on 

ill 




1 Szl 


— §i — 

25 


on 
zu 


-42 42 


1 SzL 


B4 

#2% 


on 

zU 


4 2 7") y--) 


1 t^O 
IOZ 




on 


n 5 


1 on 


f 

3 


on 


A& 
A 5 


1 on 

IZU 


8 

« 


21 


A20O1 


420 


25TI 

— HI — 


21 


A 13 E 7 0! 


308 




21 


AnDgOl 


276 


gi 

2%, 


21 


Ai2AgOi 


228 




01 
Zl 


n„ A „ /7V/Q-, 


01 

Z1Z 


f 


01 
Zl 




1 sn 

loU 


±3y 


01 
Zl 


/i g /l4Ui 


1041 


2% 


01 




1 zl£ 


§1 

3k 


01 


43 A„r>, 

JAqA 2 U\ 


1 ^0 
IOZ 




Ol 




1 Ifi 
110 


& 

2& 


Ol 


45^ 


1 nn 

1UU 


— m — 


Ol 

Z J. 


A 3 




1 1 


22 


D14E7A1 


492 


64 

I 


22 


E 8 E 2 


492 




22 




364 


g 


22 


Ai 5 D 6 Oi 


300 


¥ 


22 




300 


g 


22 


D8.E7A5A1 


300 


1 


22 


A13D7A1O1 


268 


th 


22 




236 


§3 


22 


— 7^ 

A 10°2 


220 


2$; 


22 


7J2 a 1 


204 


ik 


22 


A11D5A5A1 


204 







22 


A 9 D 7 A 5 Oi 


204 


— \% — 


22 


AqEuDbA^! 


204 




22 


1 — 1 2 A 2 

DlD\A{ 


172 


3§ 


22 


AjD 6 2 


172 


& 


22 


A 9 A 7 D 4 A 1 2 


172 


& 

2^ 


22 


A 8 A\0 2 


156 




22 


A2 A2 A2 


140 


ft 


22 


D 2 A{0 2 


140 


— m — 


22 


A7D5A5A3A101 


140 


— m — 


22 


A^O a 


124 


— — 


22 


D\A\ 


108 


— n — 


22 


AlAsAfOr 


108 


— gi — 


22 


A|D 4 A§0 2 


108 


— a — 

21 



dim 


lattice 


kissing number 


secrecy gain 


22 


A\A l 2 02 


92 


M 


22 


A|A 2 2 


76 


A 


22 


Af0 2 


60 





22 


Aj 2 


44 


lb 


23 


A 15 E 8 


480 


1^8 

51 


23 


A19A4 


400 


'ISti 

97 


23 


D11A11O1 


352 


vJh 

47 


23 


AnE 7 A 5 


288 


SSh 

45 


23 


A 9 E 7 E 6 0! 


288 


rife 

45 


23 


d 9 e£o 2 


288 


1*28 
4fi 


23 


Ai 4 £ 6 A 2 Oi 


288 


1*28 

45 


23 


D 9 Ai> 


256 


32 
1 1 


23 


Ai 3 A 8 AiOi 


256 


32 

1 1 


23 


AnDgAaOi 


256 


32 
1 1 


23 


DgA^O! 


224 


128 

43 


23 


D^A 7 2 


224 


r& 

43 


23 


A11A7A4O1 


208 


2KB 

85 


23 


A 10 A 9 A 2 A 1 O 1 


208 


'&ti 

85 


23 


E 6 D'i0 2 


192 


Si 
2.1 


23 


E 6 D 6 Aip 1 


192 


Si 
?A 


23 


D 7 A 7 D 5 A 3 1 


192 


61 
21 


23 


A 8 £ 6 A 6 A 2 Oi 


192 


Si 

21 


23 


A 10 A 6 D 5 O 2 


192 


Si 
2.1 


23 


A 9 D 6j D 5 Ai02 


192 


Si 

21 


23 


DtOz 


160 


128 

41 


23 


A 9 A 5 AlOi 


160 


1*28 
41 


23 


D 6 D 5 A? o 2 


160 


VJH 

41 


23 


AtDzA^AzAxOx 


160 


41 


23 


A a A 6 D 5 A 2 2 


160 


128 

41 


23 


A8A7A5A1O5. 


160 


128 

41 


23 


AsAiAid 


144 


■JSti 

81 


23 


A 7 iA 4 A 3 A 2 


144 


25 (i 

81 


23 


A 7 A 2 6 A(0 2 


144 


25B 

81 


23 


DiAiO, 


128 


IS 


23 


A 7 DlAi0 2 


128 


sM 


23 


A 7 A$A\A\0 2 


128 


lb 

5 


23 


D 5 AlD 4 Al 


128 


lb 

5 


23 


AiD4.A4.O3 


128 


ib 


23 


A 6 DsA 2 4 A 2 2 


128 


ik 


23 


A^AaA^s 


112 


2*!b 

79 


23 


A(,A h A4A z A 2 A x 2 


112 


256 

7? 


23 


DiA%O s 


96 


128 


23 


A 2 A s A±0 2 


96 


M 


23 


A B D 4 A^Af0 2 


96 


— m — 


23 


D^AiAipz 


96 


— m — 


23 


A h A\AiA L 0-i 


96 


— m — 


23 


A 4 A^0 4 


80 


— 2^ — 
— & — 


23 


AlA 2 A 2 2 A{O z 


80 


— m — 


23 


A|A«O s 


64 




23 


A\A\A{0 4 


64 


— ® — 


23 


A>A{0 5 


48 


— & — 


23 


A{ O r 


32 


— 1& — 

37 
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8 10 12 14 16 18 20 

Dimension ;? 



Fig. 3. Lower bound of the minimal secrecy gain as a function of n from 
Siegel-Weil formula for even unimodular lattices. Points correspond to best 
unimodular lattices. 

A. Construction A 

There is a classic way of constructing lattices from binary 
linear codes called Construction A. Let p : Z™ — > FJf be the 
map of componentwise reduction modulo 2 defined on Z" . Let 
C be a binary [n, k, d] code. Then p~ 1 (C) is a free Abelian 
group of rank n and hence is a lattice in R". 

Definition 4.1: The lattice Yc generated by C is defined by 

r c := -L„-Hc). 

To help identify which, if any, error correction code corre- 
sponds to a given lattice, we use the following known results: 

Theorem 4.2: ifTTl Let C be a binary linear code and Yc 
be the lattice generated by C. Then 

1) C C C if and only if Yc is an integral lattice; 

2) C is doubly even if and only if Yq is an even lattice; 

3) C is self-dual if and only if Yc is unimodular. 

A self-dual code is always an even code. It is called a type 
II code if it is doubly even and type I otherwise fl6l . It then 
follows from Theorem 14.21 that C is a type I (respectively 
type II) code if and only if Yc is a type I (respectively type 
II) lattice. 

Theorem 4.3: Ifl2l Let C be a binary [n, k,d] linear code 
with weight distribution Wc{k), k = 0, 1, ■ ■ ■ , n. Then the 
kissing number K(Yc) of the lattice Yc generated by C is 
given by 

( 2 d W c {d) if d < 4, 

K(T C )=\ 2n+lW c (4) if d = 4, 
[ 2n if d > 4. 

Theorem 14.31 gives a way to find the corresponding uni- 
modular lattice for each self-dual code, assuming that there 
is only one unimodular lattice having the computed kissing 
number. When we have more than one unimodular lattice with 
the same kissing number, more considerations are needed to 
distinguish them. Table III gives the list of type I codes of 
length n (8 < n < 23) [IT). According to Theorem |42j the 
lattices generated by these codes are odd unimodular lattices 



TABLE III 

Type I codes of length n (8 < n < 23) 



Codes 


weight distribution 




[12,6,4] 


(1,0,15,32,15,0,1) 


1 


[14,7,4] 


(1,0,14,49,49,14,0,1) 


1 


[16,8,4] 


(1,0,12,64,102,64,12,0,1) 


1 


[18,9,4] 


(1,0,9,75,171,171,75,9,0,1) 


, 


(1,0,17,51,187,187,51,17,0,1) 


1 


[20, 10, 4] 


(1 ,0,5,80,250,352,250,80,5,0, 1 ) 


— 


(1,0,9,72,246,368,246,72,9,0,1) 


— j— 


(1 ,0, 13,64,242,384,242,64, 1 3,0, 1) 


— j— 


(1,0,17,56,238,400,238,56,17,0,1) 


— j— 


( 1 ,0,2 1 ,48,234,4 1 6,234,48,2 1 ,0, 1 ) 


— j— 


(1,0,29,32,226,448,226,32,29,0,1) 


, 


(1,0,45,0,210,512,210,0,45,0,1) 




[22,11,6] 


(1,0,0,77,330,616,616,330,77,0,0,1) 




[22,11,4] 


(1 ,0,4,73,3 1 8,628,628,3 1 8,73,4,0, 1 ) 




( 1 ,0,8,69,306,640,640,306,69,8,0, 1 ) 




( 1 ,0, 1 2,65,294,652,652,294,65 , 1 2,0, 1 ) 




(1,0,16,61,282,664,664,282,61,16,0,1) 


2 


(1 ,0,20,57,270,676,676,270,57,20,0, 1 ) 


1 


( 1 ,0,28,49,246,700,700,246,49,28,0, 1 ) 


2 



of dimension n (8 < n < 23). The rest of the work consists 
of finding out the corresponding lattice for each code, through 
Theorem 14.31 

Proposition 4.4: Best unimodular lattices of dimension n, 
8 < n < 23 and their corresponding codes are as classified in 
Table IV. 

Proof. First by Tables I and II as well as the observations 
following Propositions l3.3l and l3.4l the best unimodular lattices 
are as shown in Table IV. Now we find their corresponding 
codes. That the code for the lattice E$ is the [8, 4, 4] Extended 
Hamming code was mentioned in fTOl . We only need to show 
the correspondence for all the even dimensions from 12 to 
22. And since by Theorem 14.21 the lattices generated by the 
type I codes in Table III are odd unimodular lattices, the 
correspondence can be shown by finding the corresponding 
lattice for each type I code. For n = 12, 14 and 16, there 
is only one code of the respective length and only one odd 
unimodular lattice of the respective dimension, hence it is 
clear. Let us now deal with the rest of the even dimensions 
one by one, from 22 to 18. Since according to the observation 
following Proposition 13.41 the best unimodular lattices are 
those with the smallest kissing numbers, we can directly search 
for the codes that give the smallest kissing numbers. For 
n = 22, [22,11,6] has a minimum distance of 6, which is 
greater than 4. According to Theorem l4.3l the generated lattice 
has kissing number 44, which is the smallest a type I code of 
length 22 can give. By refering to Table II, we know that it 
is the lattice (Af )+. For n = 20, [20, 10,4] with W c (4) = 5 
will give the smallest kissing number and applying Theorem 
I4.3l again yields K(Ac) = 120. There are two odd unimodular 
lattices both with the same kissing number 120, namely, (^4|) + 
and (Z?!) + . Finally, for n = 18, we have a similar situation. 
The code [18, 9, 4] with Wc(4) = 9 gives the smallest kissing 
number 180 and there are two odd unimodular lattices, {Aq) + 
and (Dg) + , both with the same kissing number 180. 

For the odd dimensions, the unimodular lattices cannot be 
obtained from Construction A, since the conditions in Theorem 
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TABLE IV 

Best unimodular lattices of dimension?!, 8 < n < 23 and the 

CORRESPONDING CODES 



which together with (fTTT i gives 



dim 


lattice 


codes 


9 


E s © Z 


[8, 4, 4] 


10 


E & ®t z 


[8,4,4] 


11 


E 8 ©Z d 


[8, 4, 4] 


12 




[12,6,4] 


13 


D+ 2 © Z 


[12,6,4] 


14 


(^) + 


[14,7,4] 


15 






16 


(^) + 


[16,8,4] 


17 


(AnE 6 )+ 




18 


(A^)+ or (_>»)+ 


[18,9,4] with Wc(4) = 9 


19 






20 


(Ag)+ or (_>,)+ 


[20,10,4] with W c (4:) = 5 


21 


(^) + 




22 


(Af)+ 


[22,11,6] 


23 


o 2:! 





14.21 are necessary and sufficient and there does not exist self- 
dual binary codes of odd length. The proof is completed. 



B. Coset encoding 

With Construction A, a unimodular lattice A can be written 

aS 1 1 

V2Z n + —=[n, k, d] or I) -^(2Z n + a), 

^ 2 c t ec ^ 2 

where C = [n, k, d] is the binary linear code that generates 
A. The encoding is normally done by mapping k bits of 
information for a codeword of C and n[~log 2 (m)] bits of 
information for a bounded set of Z" around the origin given by 
{0, 1, . . . , m — 1}. In the case of coset encoding for a wiretap 
channel, we can adapt this encoding by setting A e = A, and 
A b = s/21 n , in which case, k bits of information are indeed 
used for a codeword of C, thus determining a coset, while the 
other bits are either random or least significant. In doing so, 
we are increasing the confusion at the eavesdropper, however, 
there is no special coding for Bob. Let us write 

1 



A e = spill' 



n, k, d]. 



Since 



we have that 



V2 

Z" = 2Z" + [n,n,l], 



-=Z n = V2Z n + - p [n,n,l] 
v 2 v 2 



(17) 



which combined with ( fTTI i yields 



—=Z n + —= \n, n, 11 + — = In, k, d] 
\/2 



where by definition [n, k, d] + C' = [n, n, 1]. Scaling this last 
equation, we further obtain 

2A e = V2Z" + 



1 



A e = 2A e + V2C7 f + -^=[n, k, d] 

By doing so, we can alternatively choose A b = 2A e instead 
of v/2Z". 



V. Conclusion and future work 

A recent line of work on lattice codes for Gaussian wiretap 
channels introduced a new lattice invariant called secrecy gain 
as a code design criterion which captures the confusion that 
lattice coding can introduce at an eavesdropper. So far, only 
the secrecy gain of even unimodular lattices was studied. 
In this paper, we pursued the study of unimodular lattices 
by investigating the case of odd unimodular lattices, which 
exist in greater number and, unlike even lattices, in any 
dimension. We provided a general formula for the secrecy 
gain of unimodular lattices in general. We then computed the 
secrecy gain for odd unimodular lattices, both extremal, and 
in small dimensions. As a result, we gave a classification of 
the best unimodular lattice wiretap codes in small dimensions. 

Future work on unimodular wiretap lattice codes concerns 
the asymptotic behavior of odd unimodular lattices. More 
generally, it is of interest to generalize the existing work on 
unimodular lattices to other classes of lattices. 
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